Microsoft offers workaround for Word flaw |
 |
By Bill Brenner, Senior News Writer
24 May 2006 | SearchSecurity.com |
|
|
Microsoft confirmed Tuesday that a previously unknown flaw in its Word application is being actively exploited. To blunt the threat, the vendor suggested customers only use Word in safe mode.
"Microsoft is investigating new public reports of limited 'zero-day' attacks using a vulnerability in Microsoft Word XP and Microsoft Word 2003," the company said in an advisory published this week. "In order for this attack to be carried out, a user must first open a malicious Word document attached to an email or otherwise provided to them by an attacker."
The advisory offers tells customers how to run the flawed Word 2002 and Word 2003 programs in safe mode. Microsoft also listed the following guidelines for using Office documents in safe mode:
Don't open Word files that are embedded in other applications, such as Excel, PowerPoint or others.
Even after the workarounds are applied, refrain from opening Word files directly from any mail clients (Outlook or Hotmail, for example) by double-clicking them. Users should save Word documents to a disk or on the desktop and use the "Word Safe Mode" shortcut.
Don't open .doc files from a Web site through Internet Explorer or any other browser.
If customers don't see "safe mode" in the Word title bar, they are not running Word in safe mode.
Customers should use Word Viewer 2003 to open and view files. The free Word Viewer 2003 does not contain the vulnerable code and is not susceptible to the current exploit.
Targeted exploit code that takes advantage of Microsoft Word to open a backdoor for attackers was first reported in the wild late last week.
Cupertino, Calif.-based antivirus giant Symantec Corp. raised its ThreatCon level from 1 to 2 (on a scale of 4) as a result of the exploit, currently known as Trojan.Mdropper.H.
Symantec said the zero-day exploit arrives as a Word document attached to an email. The document appears to be of Japanese origin and includes text summarizing a recent U.S.-Asian political summit.
The document's OLE structure is a dropper program called Backdoor.Ginwui. Once a victim opens the document, that program creates a backdoor for attackers to exploit the system using a previously unknown vulnerability.
The software giant said it is completing a security bulletin for Word to address the vulnerability. "The security update is now being finalized through testing to ensure quality and application compatibility and is on schedule to be released as part of the June security updates on June 13, 2006, or sooner as warranted," Microsoft said.
|
|
|
|
